Description
A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 4.0.11
References
Could your website be exposed too?
SmartScanner can check your website for jQuery-Upload-File XSS in fileNameStr and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Unrestricted Upload of File with Dangerous Type in jquery-file-upload - CVE-2018-9207
- XSS in the `of` option of the `.position()` util in jquery-ui - CVE-2021-41184
- XSS in the `altField` option of the Datepicker widget in jquery-ui - CVE-2021-41182
- XSS in `*Text` options of the Datepicker widget in jquery-ui - CVE-2021-41183
You might also like:
See something that needs correcting? Let us knowUpdated April 02, 2024